shushi---cdn--swap[.]webflow[.]io

Analysis as of July 23, 2026 indicates that the domain shushi---cdn--swap.webflow.io is actively being used for a crypto‑related brand‑impersonation campaign. The site resolves to the Cloudflare edge address 172.64.151.8, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. The hosting infrastructure is provided by Webflow, as shown by the registration record and the presence of Webflow‑specific page elements. The observed page title “Swap | Sushi” matches the pattern used in the campaign and the intel classifies the activity as a “Crypto Scam”. VirusTotal has recorded detections from 15 of 94 scanned security vendors, indicating a moderate level of malicious detection across the scanning community.

The domain is listed on a single external security blocklist and has been manually blocked by the PhishDestroy service. Additional reputation signals are extremely negative: Gridinsoft assigns a trust score of 0 / 100, and the DNS lookup returns NS_NOT_FOUND, suggesting that authoritative name server information is unavailable or deliberately concealed. HTTP requests to the host return a 403 status code, which may be a defensive response after the takedown of the malicious content; the current operational status is reported as offline. The available evidence confirms that the domain is associated with a brand‑impersonation scheme targeting the “across” brand, although the specific brand name is not disclosed in the provided data.

No SSL certificate details, Safe Browsing verdicts, or Open Threat Exchange entries are present, leaving those vectors unverified. Defenders should continue to block the IP 172.64.151.8 and the domain itself at perimeter filters, monitor for any re‑registration of the host under a different subdomain, and consider adding the domain to internal deny lists. Ongoing observation of the underlying Cloudflare address is advised, as the infrastructure could be repurposed for future campaigns.